Sophos announced the general availability of Sophos AI Defense, which finds the AI tools employees and applications are using, including the ones security teams never approved, and enforces policy wherever they run. Every AI tool an organisation can’t see is a potential gap in confidentiality, integrity, and availability. Delivered through Sophos Fusion, the AI-native cybersecurity defense system, Sophos AI Defense connects controls on the device, across the network, at sign-in, and in the browser into one line of defense, so teams can safely adopt AI faster without adding another disconnected tool to manage.
Attackers see the same opportunity in AI that businesses do. This year alone, Sophos X-Ops has tracked an attacker using AI agents inside a customer’s network to build and test nearly 80 malware modules; threat actors selling brokered API keys for frontier AI models; underground forums trading jailbreak techniques; and criminal recruiters seeking AI prompt engineers.
Most organisations already have AI running that they never approved. Sixty-nine percent suspect or have evidence that employees are using unsanctioned Agents and AI tools, 82% have discovered shadow AI agents in their environments in the past year, and 90% of IT leaders are concerned about shadow AI risk. The problem is about to scale, with IDC projecting 1.3 billion AI agents by 2028.
Each of those agents and tools is both a new attack surface and a new way for sensitive data to leave the business. Sophos AI Defense pulls signals from the device, network, identity, and browser layers to map AI activity across an environment, then weighs who is acting, how they’re behaving, and what data is involved to separate routine use from activity that warrants action. Real-time guardrails, designed to help prevent sensitive data exposure, inspect prompts, uploads, and other AI interactions as they happen. That activity also flows into the Sophos Fusion system, so security teams using Sophos XDR, along with Sophos MDR analysts, can investigate and respond through the workflows they already know.
“Organisations are adopting AI faster than they can secure it, and most security teams can’t answer three basic questions: which AI tools are running, what data is going into them, and whether that activity lines up with policy,” said Kyle Falkenhagen, senior vice president of product management, Sophos. “Sophos AI Defense gives security teams that visibility and the control to act on it, so they can say yes to AI and know exactly what they’re saying yes to.”
Because Sophos AI Defense runs on Sophos Fusion, under-resourced security teams can activate AI security from day one, and managed service providers (MSPs) gain a new capability to deliver across their customer base. The launch comes during Cybersecurity Awareness Month, as safe AI adoption moves up the agenda for organisations of every size.
“Our customers started asking how we were using AI and how we were protecting it,” said Anthony Bender, CTO at Empyreal Logistics. “We didn’t have a good answer. We had no way to block and regulate the use of unsanctioned AI tools. We now have a handle on how we want our employees to use AI, and we can show our customers we are doing what we are saying. Now when our customers ask, we have a great answer for them.”
Sophos AI Defense is available now.
Express Computer is one of India's most respected IT media brands and has been in publication for 24 years running. We cover enterprise technology in all its flavours, including processors, storage, networking, wireless, business applications, cloud computing, analytics, green initiatives and anything that can help companies make the most of their ICT investments. Additionally, we also report on the fast emerging realm of eGovernance in India.